Evidence · Local synthetic checks

Inspect the claim.
Reproduce the check.

On October 26, 2026, the existing mock policy’s local Node.js test suite passed eight tests, with zero skipped or TODO tests. This is evidence about the supplied evaluator and fixtures, not a production deployment or an effectiveness benchmark.

The local run was observed at 12:08:53 UTC on October 26, 2026, using Node.js v25.9.0. View the fixture manifest and observed decisions.

What was checked

• Public synthetic reads versus lexical path bypass and protected paths.
• Exact example recipient domain and defined fake sensitive markers.
• Unknown tools, extra fields, forged approval contexts, and malformed records.
• One export CSV deletion scope and separate simulated approval.
• Exact-request approval binding, one-time use, and action separation.
• Approval cannot override a denial or survive mutation of captured arguments.
• Deterministic scenario decisions; a synthetic injection note grants no authority.
• Fingerprint argument fidelity and object key-order independence.

Reproduce locally

Download the three adjacent files below into one local directory. With a compatible recent Node.js runtime, run this command there. It needs no package installation, API key, or production access.

node --test policy.test.mjs

• policy.mjs
• scenarios.mjs
• policy.test.mjs
• Reproduction notes

Source identity

These SHA-256 hashes identify the exact source files linked in this edition. Hashes identify bytes; they are not a security certification.

What this does not establish

The tests do not run a real tool, read or delete a file, send an external message, spend money, make a network request, or call a model. They do not establish resistance to every injection, secret disclosure, encoding, race, symlink, tenant isolation failure, or alternate execution path. A browser-side simulator can be modified by its user.

The demonstration uses lexical path rules and known fake markers. Its indirect-injection fixture is denied by recipient policy, not by understanding the malicious document. Request fingerprints are canonical serialization, not cryptographic approval credentials.

Product status and open work

Boundary is a prelaunch commercial model router. Planned request-path checks are separate from this mock agent-action demonstration. Trusted server-side enforcement, authenticated approval, atomic redemption, real resource resolution, integration coverage, and operational validation remain requirements for any real action-control implementation. Read the precise product scope.